Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Malware & Threats

Microsoft Targets Code Hijacking With Release of EMET 5.2

Microsoft has released version 5.2 of its Enhanced Mitigation Experience Toolkit (EMET), which offers increased security protections in several areas, including code hijacking attacks and improvements in Attack Surface Reduction (ASR) mitigation.

Microsoft has released version 5.2 of its Enhanced Mitigation Experience Toolkit (EMET), which offers increased security protections in several areas, including code hijacking attacks and improvements in Attack Surface Reduction (ASR) mitigation.

For those unfamiliar with the tool, as Microsoft explains it, EMET “anticipates the most common actions and techniques adversaries might use” in compromising a computer, and helps protect systems against new and undiscovered threats and exploits by diverting, terminating, blocking, and invalidating those actions and techniques.

According to Microsoft, EMET 5.2’s native DLLs have been compiled with Control Flow Guard (CFG), a new feature introduced in Visual Studio 2015 that helps detect and stop attempts of code hijacking. EMET native DLLs (i.e. EMET.DLL) are injected into the application process EMET protects, Microsoft said.

Because Microsoft strongly encourages 3rd party developers to recompile their application to take advantage of the latest security technology, EMET has been compiled with CFG. More information on CFG is available in a blog post from the this Visual C++ Team. 

Additionally, the configuration for the ASR mitigation in EMET 5.2 has been improved to stop attempts to run the VBScript extension when loaded in the Internet Explorer’s Internet Zone. This would mitigate the exploitation technique known as “VBScript God Mode” observed in recent attacks, Microsoft explained.

Finally, EMET 5.2 fully supports alerting and reporting from Modern Internet Explorer, or Desktop IE with Enhanced Protected Mode enabled.

While EMET does add an extra layer of security against various attacks, the toolkit has been bypassed or disarmed on several occasions by researchers in the past.

Advertisement. Scroll to continue reading.

In late September 2014, researchers at presented a method that can be used to disarm EMET 5.0. Not long after, in Nov. 2014, researcher René Freingruber found “numerous methods to get around the basic protection mechanisms of EMET.”

Additionally, while the tool is stable overall, users should be cautious when using it, as Microsoft has warned that some security mitigation technologies may break applications. The software giant strongly suggests thoroughly testing EMET in all target use scenarios before rolling it out to a production environment.

“There is no one tool capable of preventing all attacks. EMET is designed to make it more difficult, expensive and time consuming, and therefore less likely, for attackers to exploit a system,” a Microsoft spokesperson previously told SecurityWeek.

EMET 5.2 can be downloaded from microsoft.com/emet.

Written By

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Cybercrime

The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.

Cybercrime

A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.

Vulnerabilities

Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.